On November 1, 2026, the open-source Bitcoin payment processor BTCPay Server issued an urgent advisory directing anyone running a self-hosted instance to take it offline.
The project’s official account stated that it had begun receiving reports of unauthorized parties sweeping funds from hot wallets attached to these servers and instructed operators to execute the shutdown script ./btcpay-down.sh and remain offline until the investigation concluded.
A core contributor reinforced the message shortly afterward, describing the situation as “not a drill” for any installation that maintains a hot wallet.
Founder Nicolas Dorier subsequently provided an initial assessment.
He noted that the project’s own public servers, which were running version 2.4.7, had not been targeted.
The reported compromises appeared to involve releases older than 2.4.2. In those cases, the attacker had succeeded in logging in with administrator privileges, though the precise method of gaining that access remained under examination.
Later the same day the project refined the finding, stating that its incident-response work had identified an attack vector affecting installations running version 2.4.1 (released 23 July 2026) or earlier.
It added that it had received no credible reports of hot-wallet drains from users running the latest 2.4.7 release and again urged operators to keep their software current.
Affected parties were asked to forward details and logs to the project’s security address.
The timing of the alert is notable. Version 2.4.7 had been published only three days earlier, on 29 October 2026, as an emergency security update.
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
— BTCPay Server (@BtcpayServer) November 1, 2026
That release addressed 85 findings—one critical, 13 high-severity, 52 medium, and 19 low—surfaced by Anthropic’s open-source scanning program.
The BTCPay team publicly credited the scanner for enabling it to remediate the issues before any known exploitation and recommended that operators update promptly.
The subsequent reports of active drains therefore arrived almost immediately after a broad security overhaul, underscoring the practical consequences for operators who had not yet applied earlier patches.
BTCPay Server is designed so that merchants retain full control of their own infrastructure and keys rather than relying on a third-party processor.
Its hot wallet feature stores the signing seed on the server itself so that the instance can generate and broadcast transactions.
While this arrangement removes intermediaries, it also means that any compromise of administrative access can result in the immediate transfer of funds.
The project has not published a total loss figure or a count of affected installations.
Because each deployment is independently operated, the scale of any impact is distributed across individual servers rather than concentrated in a single custodial pool.
The incident also sits against the backdrop of an earlier vulnerability disclosed in August 2026.
That flaw, present in all versions prior to 2.4.2, allowed unauthenticated remote attackers to obtain LND macaroon credential files and thereby control connected Lightning nodes. BTCPay stated at the time that its own on-chain hot wallets were not affected by the LND issue, and version 2.4.2 closed the vector.
The November reports, however, concern on-chain hot wallets on outdated installations and appear to involve administrator-level access rather than the previously fixed credential-exposure bug.
Operators who remain on versions older than 2.4.2 are advised to keep their instances offline until further guidance is issued, then upgrade and rotate any credentials that may have been exposed.
Those already running 2.4.7 have so far seen no credible reports of compromise, yet the project continues to emphasize regular updates and the practice of keeping only minimal balances in hot wallets. A more detailed blog post was promised once the investigation yields additional findings.
